A critical heap-based buffer overflow vulnerability in the International Color Consortium iccDEV library (prior to version 2.3.1.2) poses a significant risk of arbitrary code execution for applications processing untrusted ICC color profiles.

The vulnerability is a heap-based buffer overflow located in the SIccCalcOp::Describe() function within the IccProfLib/IccMpeCalc.cpp source file. An unauthenticated attacker can trigger this flaw by providing a specially crafted ICC color profile to an application utilizing the affected library.

The CVSS score of 8.8 reflects the high potential for impact, as this flaw could allow an attacker to gain unauthorized control over systems processing color management data. Successful exploitation may result in full system compromise, data exfiltration, or denial of service, creating substantial operational and security risks for organizations that rely on this library for image or document processing pipelines.

Immediate Action: Update the iccDEV library to version 2.3.1.2 or later to incorporate the necessary memory safety patches.

Proactive Monitoring: Review application logs for crashes or abnormal behavior occurring during the ingestion of image or color profile files, which may indicate attempted exploitation.

Compensating Controls: Implement strict input validation or sandboxing for any service that parses ICC profiles to ensure that malformed data is isolated from the main application process.

Public Exploit Available: No (Exploit_available: false)

Given the severity of potential remote code execution, organizations must prioritize upgrading the iccDEV library across all affected production environments immediately. Failure to patch leaves systems vulnerable to memory-based attacks that are difficult to detect without robust endpoint protection and rigorous file sanitization processes.